For many travelers, connecting to hotel Wi-Fi is one of the first things they do after checking in. But while some guests use the network for banking and work, others avoid sensitive activity unless they are connected through a VPN.
So, how safe is hotel Wi-Fi?
Cybersecurity experts say the answer is more nuanced than simply calling public Wi-Fi dangerous. Modern encryption has reduced many of the risks associated with public networks, but hotel Wi-Fi can still expose travelers to rogue networks, phishing attacks, poorly configured infrastructure and vulnerable devices.
In many cases, the biggest risk may not be the network itself, but how the user connects to and behaves on it.
The first risk can come from a fake network
Security analyst Udaya Vemuri advises travelers to be cautious about joining a network simply because its name appears to belong to the hotel.
Attackers can create fake Wi-Fi networks with names almost identical to legitimate hotel networks. The technique, known as an "evil twin" attack, can trick guests into connecting to an attacker-controlled access point.
The FBI's Internet Crime Complaint Center warned about this threat in a 2020 advisory, noting that criminals can create networks resembling legitimate hotel Wi-Fi and potentially monitor activity or redirect victims to fraudulent login pages. The agency also warned that hotel guests have limited control over the security of the infrastructure they are using, which may prioritize convenience over stronger security practices.
Travelers should therefore confirm the exact Wi-Fi name with hotel staff before connecting rather than selecting the network that merely looks familiar.
Simply sharing a network does not mean you are compromised
Dahvid Schloss, chief operating officer of cybersecurity firm Suzu Labs and a former government hacker who has security-tested hotel chains, takes a less alarmist view.
Schloss compares hotel Wi-Fi with other public networks, such as those in coffee shops. In his assessment, the likelihood of being attacked simply because another malicious user is connected to the same network is low.
That distinction matters because the common image of hackers automatically reading passwords from public Wi-Fi is outdated.
The Federal Trade Commission says most websites now use encryption, meaning information sent between a device and a legitimate website is generally protected even when the underlying network is public. HTTPS can therefore provide substantial protection against traffic interception.
However, HTTPS does not prove that a website is legitimate. Attackers can create encrypted fraudulent websites and use phishing or redirection to persuade victims to submit credentials.
This means a traveler can still be exposed even when the connection itself appears encrypted.
Fake hotel portals can steal credentials
Hotels commonly use captive portals that redirect guests to a webpage after they connect to Wi-Fi. These pages may request a room number, surname, email address or access code.
Because travelers expect this process, attackers can imitate it.
A rogue network may display a fake hotel login page or redirect users to a fraudulent Microsoft 365, email or banking page. In such cases, the attacker does not necessarily need to break encryption. The victim may simply be tricked into providing the information.
This makes phishing and social engineering an important part of the hotel Wi-Fi threat.
Network security is not a perfect guarantee
Recent research also shows why travelers should not assume that network-level protections make public Wi-Fi completely secure.
Researchers at the University of California, Riverside reported in February 2026 that weaknesses in Wi-Fi client isolation can, under certain conditions, allow attackers to bypass protections designed to prevent devices on the same network from interacting with one another.
Their AirSnitch research demonstrated techniques that could potentially allow an attacker to intercept or manipulate traffic despite client isolation.
The findings do not mean every hotel network is vulnerable, but they reinforce an important point: users should not rely entirely on the security mechanisms implemented by a public network.
Your device can be the weakest link
Both experts place considerable emphasis on user behavior.
Schloss argues that laptops can be particularly vulnerable to poor security habits because they are frequently used to download files, install software and access corporate systems. Smartphones are not immune, but their operating systems often impose stronger application restrictions.
The FBI recommends updating operating systems and applications before travel, keeping security software current, backing up important data, disabling Bluetooth when unnecessary and preventing devices from automatically reconnecting to public networks.
Automatic reconnection is particularly important because a device may join a previously saved network without the user consciously verifying that it is legitimate.
Br
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article: